{
    "default": "rule:admin_or_owner",

    "clustertemplate:create": "rule:deny_cluster_user",
    "clustertemplate:delete": "rule:deny_cluster_user",
    "clustertemplate:detail": "rule:deny_cluster_user",
    "clustertemplate:get": "rule:deny_cluster_user",
    "clustertemplate:get_all": "rule:deny_cluster_user",
    "clustertemplate:update": "rule:deny_cluster_user",
    "clustertemplate:publish": "rule:admin_api",

    "quotas:get": "rule:default",
    "quotas:get_all": "rule:admin_api",
    "quotas:create": "rule:admin_api",
    "quotas:update": "rule:admin_api",
    "quotas:delete": "rule:admin_api",

    "certificate:rotate_ca": "rule:admin_or_owner",
    "certificate:create": "rule:admin_or_user or rule:cluster_user",
    "certificate:get": "rule:admin_or_user or rule:cluster_user",

    "magnum-service:get_all": "rule:admin_api",
    "stats:get_all": "rule:admin_or_owner"
}